Client application specific scopes

This PR attempts to address https://github.com/doorkeeper-gem/doorkeeper/issues/317. We saw @tute's comments, but could not find a great way to implement this without either putting all of the logic into the authoriizations controller (doing an end run around the work that the `OAuth::PreAuthorizations` class does, or monkeypatching Doorkeeper a bit. So I created this PR in an attempt to implement this functionality in a way that fits with the rest of the Doorkeeper API.

It works by adding a `scopes` field to the `Doorkeeper::Application` model and validating the requested scopes against it during pre-authorization. When `enable_application_scopes` is set, the `Doorkeeper::Models::Scopes` mixin is added to `Doorkeeper::Application` and `validate_scopes` will check both the server/config scopes as well as the client application's scopes.

Still TODO: adding support to the admin pages and testing with ORM's besides ActiveRecord

In the meantime, I would greatly appreciate some feedback.

thanks,
-chris

We don't need the config, it should always be enabled, as the spec expects this.